diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 166587d3284..4fad249097c 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1140,6 +1140,13 @@ Here are some more packages that provide a setup hook. Since the list of hooks i
 Many other packages provide hooks, that are not part of `stdenv`. You can find
 these in the [Hooks Reference](#chap-hooks).
 
+### Compiler and Linker wrapper hooks {#compiler-linker-wrapper-hooks}
+
+If the file `${cc}/nix-support/cc-wrapper-hook` exists, it will be run at the end of the [compiler wrapper](#cc-wrapper).
+If the file `${binutils}/nix-support/post-link-hook` exists, it will be run at the end of the linker wrapper.
+These hooks allow a user to inject code into the wrappers.
+As an example, these hooks can be used to extract `extraBefore`, `params` and `extraAfter` which store all the command line arguments passed to the compiler and linker respectively.
+
 ## Purity in Nixpkgs {#sec-purity-in-nixpkgs}
 
 *Measures taken to prevent dependencies on packages outside the store, and what you can do to prevent them.*
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index b731b8b72a3..f9478fbf83d 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -1171,6 +1171,19 @@
           Add udev rules for the Teensy family of microcontrollers.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The Qt QML disk cache is now disabled by default. This fixes a
+          long-standing issue where updating Qt/KDE apps would sometimes
+          cause them to crash or behave strangely without explanation.
+          Those concerned about the small (~10%) performance hit to
+          application startup can re-enable the cache (and expose
+          themselves to gremlins) by setting the envrionment variable
+          <literal>QML_FORCE_DISK_CACHE</literal> to
+          <literal>1</literal> using e.g. the
+          <literal>environment.sessionVariables</literal> NixOS option.
+        </para>
+      </listitem>
       <listitem>
         <para>
           systemd-oomd is enabled by default. Depending on which systemd
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 0f0e3c7a2e5..298eaabc10d 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -354,6 +354,14 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - Add udev rules for the Teensy family of microcontrollers.
 
+- The Qt QML disk cache is now disabled by default. This fixes a 
+  long-standing issue where updating Qt/KDE apps would sometimes cause 
+  them to crash or behave strangely without explanation. Those concerned 
+  about the small (~10%) performance hit to application startup can 
+  re-enable the cache (and expose themselves to gremlins) by setting the 
+  envrionment variable `QML_FORCE_DISK_CACHE` to `1` using e.g. the 
+  `environment.sessionVariables` NixOS option.
+
 - systemd-oomd is enabled by default. Depending on which systemd units have
   `ManagedOOMSwap=kill` or `ManagedOOMMemoryPressure=kill`, systemd-oomd will
   SIGKILL all the processes under the appropriate descendant cgroups when the
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix
index 8a6d30d1801..288cbc94a32 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-calamares.nix
@@ -16,5 +16,10 @@ in
     calamares-nixos-extensions
     # Needed for calamares QML module packagechooserq
     libsForQt5.full
+    # Get list of locales
+    glibcLocales
   ];
+
+  # Support choosing from any locale
+  i18n.supportedLocales = [ "all" ];
 }
diff --git a/nixos/modules/services/x11/display-managers/sddm.nix b/nixos/modules/services/x11/display-managers/sddm.nix
index 34239221315..e86a18ff618 100644
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@@ -269,20 +269,5 @@ in
     # To enable user switching, allow sddm to allocate TTYs/displays dynamically.
     services.xserver.tty = null;
     services.xserver.display = null;
-
-    systemd.tmpfiles.rules = [
-      # Prior to Qt 5.9.2, there is a QML cache invalidation bug which sometimes
-      # strikes new Plasma 5 releases. If the QML cache is not invalidated, SDDM
-      # will segfault without explanation. We really tore our hair out for awhile
-      # before finding the bug:
-      # https://bugreports.qt.io/browse/QTBUG-62302
-      # We work around the problem by deleting the QML cache before startup.
-      # This was supposedly fixed in Qt 5.9.2 however it has been reported with
-      # 5.10 and 5.11 as well. The initial workaround was to delete the directory
-      # in the Xsetup script but that doesn't do anything.
-      # Instead we use tmpfiles.d to ensure it gets wiped.
-      # This causes a small but perceptible delay when SDDM starts.
-      "e ${config.users.users.sddm.home}/.cache - - - 0"
-    ];
   };
 }
diff --git a/pkgs/applications/audio/flac/default.nix b/pkgs/applications/audio/flac/default.nix
index bebb35f4500..be987fccd66 100644
--- a/pkgs/applications/audio/flac/default.nix
+++ b/pkgs/applications/audio/flac/default.nix
@@ -10,12 +10,12 @@
 
 stdenv.mkDerivation rec {
   pname = "flac";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
     # Official checksum is published at https://github.com/xiph/flac/releases/tag/${version}
-    sha256 = "91303c3e5dfde52c3e94e75976c0ab3ee14ced278ab8f60033a3a12db9209ae6";
+    sha256 = "sha256-4yLVih9I0j2d049DJnKGX2955zpvnMWl9X/KqD61qOQ=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://xiph.org/flac/";
     description = "Library and tools for encoding and decoding the FLAC lossless audio file format";
+    changelog = "https://xiph.org/flac/changelog.html";
     platforms = platforms.all;
     license = licenses.bsd3;
     maintainers = with maintainers; [ ruuda ];
diff --git a/pkgs/build-support/cc-wrapper/cc-wrapper.sh b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
index 78759f2cfbb..cf9a351f395 100644
--- a/pkgs/build-support/cc-wrapper/cc-wrapper.sh
+++ b/pkgs/build-support/cc-wrapper/cc-wrapper.sh
@@ -219,6 +219,12 @@ fi
 PATH="$path_backup"
 # Old bash workaround, see above.
 
+# if a cc-wrapper-hook exists, run it.
+if [[ -e @out@/nix-support/cc-wrapper-hook ]]; then
+    compiler=@prog@
+    source @out@/nix-support/cc-wrapper-hook
+fi
+
 if (( "${NIX_CC_USE_RESPONSE_FILE:-@use_response_file_by_default@}" >= 1 )); then
     exec @prog@ @<(printf "%q\n" \
        ${extraBefore+"${extraBefore[@]}"} \
diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
index b85796e2a41..aeddeef29d9 100644
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@@ -27,7 +27,7 @@ cargoSetupPostUnpackHook() {
     cat ${tmp_config} >> .cargo/config
 
     cat >> .cargo/config <<'EOF'
-    @rustTarget@
+    @cargoConfig@
 EOF
 
     echo "Finished cargoSetupPostUnpackHook"
diff --git a/pkgs/build-support/rust/hooks/default.nix b/pkgs/build-support/rust/hooks/default.nix
index 652b074c302..9d3fc9b126e 100644
--- a/pkgs/build-support/rust/hooks/default.nix
+++ b/pkgs/build-support/rust/hooks/default.nix
@@ -68,15 +68,37 @@ in {
         # The `.nativeDrv` stanza works like nativeBuildInputs and ensures cross-compiling has the right version available.
         diff = "${diffutils.nativeDrv or diffutils}/bin/diff";
 
-        # Target platform
-        rustTarget = ''
-          [target."${rust.toRustTarget stdenv.buildPlatform}"]
+        # We want to specify the correct crt-static flag for both
+        # the build and host platforms. This is important when the wanted
+        # value for crt-static does not match the defaults in the rustc target,
+        # like for pkgsMusl or pkgsCross.musl64; Upstream rustc still assumes
+        # that musl = static[1].
+        #
+        # By default, Cargo doesn't apply RUSTFLAGS when building build.rs
+        # if --target is passed, so the only good way to set crt-static for
+        # build.rs files is to use the unstable -Zhost-config Cargo feature.
+        # This allows us to specify flags that should be passed to rustc
+        # when building for the build platform. We also need to use
+        # -Ztarget-applies-to-host, because using -Zhost-config requires it.
+        #
+        # When doing this, we also have to specify the linker, or cargo
+        # won't pass a -C linker= argument to rustc.  This will make rustc
+        # try to use its default value of "cc", which won't be available
+        # when cross-compiling.
+        #
+        # [1]: https://github.com/rust-lang/compiler-team/issues/422
+        cargoConfig = ''
+          [host]
           "linker" = "${ccForBuild}"
-          ${lib.optionalString (stdenv.buildPlatform.config != stdenv.hostPlatform.config) ''
-            [target."${shortTarget}"]
-            "linker" = "${ccForHost}"
-          ''}
+          "rustflags" = [ "-C", "target-feature=${if stdenv.buildPlatform.isStatic then "+" else "-"}crt-static" ]
+
+          [target."${shortTarget}"]
+          "linker" = "${ccForHost}"
           "rustflags" = [ "-C", "target-feature=${if stdenv.hostPlatform.isStatic then "+" else "-"}crt-static" ]
+
+          [unstable]
+          host-config = true
+          target-applies-to-host = true
         '';
       };
     } ./cargo-setup-hook.sh) {};
diff --git a/pkgs/data/misc/tzdata/default.nix b/pkgs/data/misc/tzdata/default.nix
index 2d5100906ed..1453b3899ef 100644
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@@ -1,17 +1,17 @@
-{ lib, stdenv, fetchurl, buildPackages }:
+{ lib, stdenv, fetchurl, fetchpatch, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "tzdata";
-  version = "2022e";
+  version = "2022f";
 
   srcs = [
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-      hash = "sha256-jeTCaG3OPRqukDBxnmgUkxwhai1eiR7D0zLm9lFq7M0=";
+      hash = "sha256-mZDXH2ddISVnuTH+iq4cq3An+J/vuKedgIppM6Z68AA=";
     })
     (fetchurl {
       url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-      hash = "sha256-1AKAJTmA6JFo5r5CdahSv5UhUk1HaE3jE1uaXKOHcQs=";
+      hash = "sha256-5FQ+kPhPkfqCgJ6piTAFL9vBOIDIpiPuOk6qQvimTBU=";
     })
   ];
 
@@ -19,6 +19,17 @@ stdenv.mkDerivation rec {
 
   patches = lib.optionals stdenv.hostPlatform.isWindows [
     ./0001-Add-exe-extension-for-MS-Windows-binaries.patch
+  ] ++ [
+    (fetchpatch {
+      name = "fix-get-random-on-osx-1.patch";
+      url = "https://github.com/eggert/tz/commit/5db8b3ba4816ccb8f4ffeb84f05b99e87d3b1be6.patch";
+      hash = "sha256-FevGjiSahYwEjRUTvRY0Y6/jUO4YHiTlAAPixzEy5hw=";
+    })
+    (fetchpatch {
+      name = "fix-get-random-on-osx-2.patch";
+      url = "https://github.com/eggert/tz/commit/841183210311b1d4ffb4084bfde8fa8bdf3e6757.patch";
+      hash = "sha256-1tUTZBMT7V463P7eygpFS6/k5gTeeXumk5+V4gdKpEI=";
+    })
   ];
 
   outputs = [ "out" "bin" "man" "dev" ];
diff --git a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
index 0302f2ad309..e356a27b78b 100644
--- a/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/10/compiler-rt/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
     "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
diff --git a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
index e4ba52030ba..a8205213c89 100644
--- a/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/11/compiler-rt/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
     "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl || isNewDarwinBootstrap) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
diff --git a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
index ed34d06ed98..a372030b3f8 100644
--- a/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/12/compiler-rt/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
     "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
diff --git a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
index 9124686705a..798280f0c1c 100644
--- a/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/13/compiler-rt/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
     "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl || isAarch64) [
     "-DCOMPILER_RT_BUILD_LIBFUZZER=OFF"
diff --git a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
index ef2495714e4..669c6bbb958 100644
--- a/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
+++ b/pkgs/development/compilers/llvm/14/compiler-rt/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     "-DCOMPILER_RT_DEFAULT_TARGET_ONLY=ON"
     "-DCMAKE_C_COMPILER_TARGET=${stdenv.hostPlatform.config}"
     "-DCMAKE_ASM_COMPILER_TARGET=${stdenv.hostPlatform.config}"
-  ] ++ lib.optionals (haveLibc && !isMusl) [
+  ] ++ lib.optionals (haveLibc && stdenv.hostPlatform.isGnu) [
     "-DSANITIZER_COMMON_CFLAGS=-I${libxcrypt}/include"
   ] ++ lib.optionals (useLLVM || bareMetal || isMusl) [
     "-DCOMPILER_RT_BUILD_SANITIZERS=OFF"
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index 6a4d01de5ef..2c9a3b1af47 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -75,7 +75,5 @@ rustPlatform.buildRustPackage {
     maintainers = with maintainers; [ retrry ];
     license = [ licenses.mit licenses.asl20 ];
     platforms = platforms.unix;
-    # weird segfault in a build script
-    broken = stdenv.targetPlatform.isMusl && !stdenv.targetPlatform.isStatic;
   };
 }
diff --git a/pkgs/development/interpreters/python/cpython/2.7/default.nix b/pkgs/development/interpreters/python/cpython/2.7/default.nix
index 7da2a0047f3..30b7732ed51 100644
--- a/pkgs/development/interpreters/python/cpython/2.7/default.nix
+++ b/pkgs/development/interpreters/python/cpython/2.7/default.nix
@@ -8,7 +8,7 @@
 , openssl
 , readline
 , sqlite
-, tcl ? null, tk ? null, tix ? null, xlibsWrapper ? null, libX11 ? null, x11Support ? false
+, tcl ? null, tk ? null, tix ? null, libX11 ? null, x11Support ? false
 , zlib
 , self
 , configd, coreutils
@@ -36,7 +36,6 @@
 
 assert x11Support -> tcl != null
                   && tk != null
-                  && xlibsWrapper != null
                   && libX11 != null;
 
 assert lib.assertMsg (enableOptimizations -> (!stdenv.cc.isClang))
@@ -234,7 +233,7 @@ let
     ++ optional (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) libffi
     ++ optional stdenv.hostPlatform.isCygwin expat
     ++ [ db gdbm ncurses sqlite readline ]
-    ++ optionals x11Support [ tcl tk xlibsWrapper libX11 ]
+    ++ optionals x11Support [ tcl tk libX11 ]
     ++ optional (stdenv.isDarwin && configd != null) configd;
   nativeBuildInputs =
     [ autoreconfHook ]
diff --git a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
index d404c6021f4..31bdec914f6 100644
--- a/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-relax-deps-hook.sh
@@ -22,6 +22,24 @@
 #     # pythonRemoveDeps = true;
 #     …
 #   }
+#
+# IMPLEMENTATION NOTES:
+#
+# The "Requires-Dist" dependency specification format is described in PEP 508.
+# Examples that the regular expressions in this hook needs to support:
+#
+# Requires-Dist: foo
+#   -> foo
+# Requires-Dist: foo[optional]
+#   -> foo[optional]
+# Requires-Dist: foo[optional]~=1.2.3
+#   -> foo[optional]
+# Requires-Dist: foo[optional, xyz] (~=1.2.3)
+#   -> foo[optional, xyz]
+# Requires-Dist: foo[optional]~=1.2.3 ; os_name = "posix"
+#   -> foo[optional] ; os_name = "posix"
+#
+# Currently unsupported: URL specs (foo @ https://example.com/a.zip).
 
 _pythonRelaxDeps() {
     local -r metadata_file="$1"
@@ -30,11 +48,11 @@ _pythonRelaxDeps() {
         return
     elif [[ "$pythonRelaxDeps" == 1 ]]; then
         sed -i "$metadata_file" -r \
-            -e 's/(Requires-Dist: \S*) \(.*\)/\1/'
+            -e 's/(Requires-Dist: [a-zA-Z0-9_.-]+\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/'
     else
         for dep in $pythonRelaxDeps; do
             sed -i "$metadata_file" -r \
-                -e "s/(Requires-Dist: $dep) \(.*\)/\1/"
+                -e "s/(Requires-Dist: $dep\s*(\[[^]]+\])?)[^;]*(;.*)?/\1\3/"
         done
     fi
 }
diff --git a/pkgs/development/libraries/aws-sdk-cpp/default.nix b/pkgs/development/libraries/aws-sdk-cpp/default.nix
index 5d5c5e95602..efe8129d3b4 100644
--- a/pkgs/development/libraries/aws-sdk-cpp/default.nix
+++ b/pkgs/development/libraries/aws-sdk-cpp/default.nix
@@ -45,6 +45,11 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    substituteInPlace cmake/compiler_settings.cmake \
+      --replace '"-Werror"' ' '
+
     # Missing includes for GCC11
     sed '5i#include <thread>' -i \
       aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \
diff --git a/pkgs/development/libraries/cppunit/default.nix b/pkgs/development/libraries/cppunit/default.nix
index 3cafa1c75d7..fba624a861d 100644
--- a/pkgs/development/libraries/cppunit/default.nix
+++ b/pkgs/development/libraries/cppunit/default.nix
@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "19qpqzy66bq76wcyadmi3zahk5v1ll2kig1nvg96zx9padkcdic9";
   };
 
+  # Avoid blanket -Werror to evade build failures on less
+  # tested compilers.
+  configureFlags = [ "--disable-werror" ];
+
   meta = with lib; {
     homepage = "https://freedesktop.org/wiki/Software/cppunit/";
     description = "C++ unit testing framework";
diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 71841e0cfbc..ac6e9bfdc38 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "expat";
-  version = "2.4.9";
+  version = "2.5.0";
 
   src = fetchurl {
     url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-bowHKP5cfNP5OmrM5DBGxeRzbHtLaOAy6TUNqg78A1Q=";
+    sha256 = "1gnwihpfz4x18rwd6cbrdggmfqjzwsdfh1gpmc0ph21c4gq2097g";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 45d8ee69a02..8e3d1a45dbe 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -7,11 +7,9 @@
 # this is just for tests (not in the closure of any regular package)
 , coreutils, dbus, libxml2, tzdata
 , desktop-file-utils, shared-mime-info
-, darwin, fetchpatch
+, darwin
 }:
 
-with lib;
-
 assert stdenv.isLinux -> util-linuxMinimal != null;
 
 # TODO:
@@ -40,20 +38,22 @@ let
     done
     ln -sr -t "''${!outputInclude}/include/" "''${!outputInclude}"/lib/*/include/* 2>/dev/null || true
   '';
+
+  buildDocs = stdenv.hostPlatform == stdenv.buildPlatform && !stdenv.hostPlatform.isStatic;
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.74.0";
+  version = "2.74.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    sha256 = "NlLH8HLXsDGmte3WI/d+vF3NKuaYWYq8yJ/znKda3TA=";
+    sha256 = "CrmBYY0dtHhF5WQXsNfBI/gaNCeyuck/Wkb/W7uWSWQ=";
   };
 
-  patches = optionals stdenv.isDarwin [
+  patches = lib.optionals stdenv.isDarwin [
     ./darwin-compilation.patch
-  ] ++ optionals stdenv.hostPlatform.isMusl [
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
     ./quark_init_on_demand.patch
     ./gobject_init_on_demand.patch
   ] ++ [
@@ -90,29 +90,8 @@ stdenv.mkDerivation (finalAttrs: {
     #    * gio-launch-desktop
     ./split-dev-programs.patch
 
-    # Fix build on Darwin
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2914
-    (fetchpatch {
-      name = "gio-properly-guard-use-of-utimensat.patch";
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/7f7171e68a420991b537d3e9e63263a0b2871618.patch";
-      sha256 = "kKEqmBqx/RlvFT3eixu+NnM7JXhHb34b9NLRfAt+9h0=";
-    })
-
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2866
-    (fetchpatch {
-      name = "tests-skip-g-file-info-test-if-atime-unsupported.patch";
-      url = "https://gitlab.gnome.org/qyliss/glib/-/commit/339a06d66685107280ca6bdca5da5d96b8222fb5.patch";
-      sha256 = "sha256-/NdFkuiJvyass3jTDEJPeciA2Lwe53IUd3kAnKAvTaw=";
-    })
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
-    ./tests-skip-shared-libs-if-default_library-static.patch
-
-    # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2921
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/glib/-/commit/f0dd96c28751f15d0703b384bfc7c314af01caa8.patch";
-      sha256 = "sha256-8ucHS6ZnJuP6ajGb4/L8QfhC49FTQG1kAGHVdww/YYE=";
-    })
-
+    # Disable flaky test.
+    # https://gitlab.gnome.org/GNOME/glib/-/issues/820
     ./skip-timer-test.patch
   ];
 
@@ -124,14 +103,14 @@ stdenv.mkDerivation (finalAttrs: {
     libelf
     finalAttrs.setupHook
     pcre2
-  ] ++ optionals (!stdenv.hostPlatform.isWindows) [
+  ] ++ lib.optionals (!stdenv.hostPlatform.isWindows) [
     bash gnum4 # install glib-gettextize and m4 macros for other apps to use
-  ] ++ optionals stdenv.isLinux [
+  ] ++ lib.optionals stdenv.isLinux [
     libselinux
     util-linuxMinimal # for libmount
-  ] ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     AppKit Carbon Cocoa CoreFoundation CoreServices Foundation
-  ]) ++ optionals (stdenv.hostPlatform == stdenv.buildPlatform) [
+  ]) ++ lib.optionals buildDocs [
     # Note: this needs to be both in buildInputs and nativeBuildInputs. The
     # Meson gtkdoc module uses find_program to look it up (-> build dep), but
     # glib's own Meson configuration uses the host pkg-config to find its
@@ -147,10 +126,18 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   nativeBuildInputs = [
-    (buildPackages.meson.override {
-      withDarwinFrameworksGtkDocPatch = stdenv.isDarwin;
-    })
-    ninja pkg-config perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 libxml2 libxslt
+    meson
+    ninja
+    pkg-config
+    perl
+    python3
+    gettext
+  ] ++ lib.optionals buildDocs [
+    gtk-doc
+    docbook_xsl
+    docbook_xml_dtd_45
+    libxml2
+    libxslt
   ];
 
   propagatedBuildInputs = [ zlib libffi gettext libiconv ];
@@ -158,10 +145,10 @@ stdenv.mkDerivation (finalAttrs: {
   mesonFlags = [
     # Avoid the need for gobject introspection binaries in PATH in cross-compiling case.
     # Instead we just copy them over from the native output.
-    "-Dgtk_doc=${boolToString (stdenv.hostPlatform == stdenv.buildPlatform)}"
+    "-Dgtk_doc=${lib.boolToString buildDocs}"
     "-Dnls=enabled"
     "-Ddevbindir=${placeholder "dev"}/bin"
-  ] ++ optionals (!stdenv.isDarwin) [
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     "-Dman=true"                # broken on Darwin
   ];
 
@@ -215,7 +202,7 @@ stdenv.mkDerivation (finalAttrs: {
     for i in $dev/bin/*; do
       moveToOutput "share/bash-completion/completions/''${i##*/}" "$dev"
     done
-  '' + optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+  '' + lib.optionalString (!buildDocs) ''
     cp -r ${buildPackages.glib.devdoc} $devdoc
   '';
 
@@ -230,7 +217,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   checkInputs = [ tzdata desktop-file-utils shared-mime-info ];
 
-  preCheck = optionalString finalAttrs.doCheck or config.doCheckByDefault or false ''
+  preCheck = lib.optionalString finalAttrs.doCheck or config.doCheckByDefault or false ''
     export LD_LIBRARY_PATH="$NIX_BUILD_TOP/glib-${finalAttrs.version}/glib/.libs''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
     export TZDIR="${tzdata}/share/zoneinfo"
     export XDG_CACHE_HOME="$TMP"
diff --git a/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch b/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
deleted file mode 100644
index 106ba4f99a9..00000000000
--- a/pkgs/development/libraries/glib/tests-skip-shared-libs-if-default_library-static.patch
+++ /dev/null
@@ -1,141 +0,0 @@
-From b804e4b82cd8e85631112d935543c62ef56783e5 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Tue, 23 Aug 2022 13:13:44 +0000
-Subject: [PATCH] tests: skip shared libs if default_library=static
-
-Otherwise, the build will fail when the toolchain is static-only, even
-with -Ddefault_library=static.  I talked to a Meson developer in their
-IRC channel, who told me that the correct fix was to ensure that
-shared_library is only used if default_library != static.
-
-Part-of: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2867
-[Backported to 2.72.3]
----
- gio/tests/meson.build  | 43 +++++++++++++++++++++++-------------------
- glib/tests/meson.build |  2 +-
- gmodule/tests/meson.build      | 30 +++++++++++++++--------------
- 3 files changed, 41 insertions(+), 34 deletions(-)
-
-diff --git a/gio/tests/meson.build b/gio/tests/meson.build
-index 3ed23a5f2..7b1aba80d 100644
---- a/gio/tests/meson.build
-+++ b/gio/tests/meson.build
-@@ -203,7 +203,7 @@ if host_machine.system() != 'windows'
-   }
- 
-   # LD_PRELOAD modules don't work so well with AddressSanitizer
--  if have_rtld_next and get_option('b_sanitize') == 'none'
-+  if have_rtld_next and get_option('default_library') != 'static' and get_option('b_sanitize') == 'none'
-     gio_tests += {
-       'gsocketclient-slow' : {
-         'depends' : [
-@@ -607,24 +607,26 @@ if not meson.is_cross_build() or meson.has_exe_wrapper()
- 
-   compiler_type = '--compiler=@0@'.format(cc.get_id())
- 
--  plugin_resources_c = custom_target('plugin-resources.c',
--    input : 'test4.gresource.xml',
--    output : 'plugin-resources.c',
--    command : [glib_compile_resources,
--               compiler_type,
--               '--target=@OUTPUT@',
--               '--sourcedir=' + meson.current_source_dir(),
--               '--internal',
--               '--generate-source',
--               '--c-name', '_g_plugin',
--               '@INPUT@'])
-+  if get_option('default_library') != 'static'
-+    plugin_resources_c = custom_target('plugin-resources.c',
-+      input : 'test4.gresource.xml',
-+      output : 'plugin-resources.c',
-+      command : [glib_compile_resources,
-+                 compiler_type,
-+                 '--target=@OUTPUT@',
-+                 '--sourcedir=' + meson.current_source_dir(),
-+                 '--internal',
-+                 '--generate-source',
-+                 '--c-name', '_g_plugin',
-+                 '@INPUT@'])
- 
--  shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
--    link_args : export_dynamic_ldflags,
--    dependencies : common_gio_tests_deps,
--    install_dir : installed_tests_execdir,
--    install : installed_tests_enabled
--  )
-+    shared_module('resourceplugin', 'resourceplugin.c', plugin_resources_c,
-+      link_args : export_dynamic_ldflags,
-+      dependencies : common_gio_tests_deps,
-+      install_dir : installed_tests_execdir,
-+      install : installed_tests_enabled
-+    )
-+  endif
- 
-   # referenced by test2.gresource.xml
-   big_test_resource = custom_target(
-@@ -917,4 +919,7 @@ if installed_tests_enabled
- endif
- 
- subdir('services')
--subdir('modules')
-+
-+if get_option('default_library') != 'static'
-+  subdir('modules')
-+endif
-diff --git a/glib/tests/meson.build b/glib/tests/meson.build
-index 301158e0f..6203ff45e 100644
---- a/glib/tests/meson.build
-+++ b/glib/tests/meson.build
-@@ -172,7 +172,7 @@ else
-     'include' : {},
-     'unix' : {},
-   }
--  if have_rtld_next
-+  if have_rtld_next and get_option('default_library') != 'static'
-     glib_tests += {
-       'gutils-user-database' : {
-         'depends' : [
-diff --git a/gmodule/tests/meson.build b/gmodule/tests/meson.build
-index c95fa1d00..25144c941 100644
---- a/gmodule/tests/meson.build
-+++ b/gmodule/tests/meson.build
-@@ -72,20 +72,22 @@ if ['darwin', 'ios'].contains(host_machine.system())
-   module_suffix = 'so'
- endif
- 
--foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
--  shared_module(module + '_plugin', 'lib@0@.c'.format(module),
--    dependencies : [libglib_dep, libgmodule_dep],
--    install_dir : installed_tests_execdir,
--    install : installed_tests_enabled,
--    name_suffix : module_suffix
--  )
--  shared_library(module + '_library', 'lib@0@.c'.format(module),
--    dependencies : [libglib_dep, libgmodule_dep],
--    install_dir : installed_tests_execdir,
--    install : installed_tests_enabled,
--    name_suffix : module_suffix
--  )
--endforeach
-+if get_option('default_library') != 'static'
-+  foreach module : ['moduletestplugin_a', 'moduletestplugin_b']
-+    shared_module(module + '_plugin', 'lib@0@.c'.format(module),
-+      dependencies : [libglib_dep, libgmodule_dep],
-+      install_dir : installed_tests_execdir,
-+      install : installed_tests_enabled,
-+      name_suffix : module_suffix
-+    )
-+    shared_library(module + '_library', 'lib@0@.c'.format(module),
-+      dependencies : [libglib_dep, libgmodule_dep],
-+      install_dir : installed_tests_execdir,
-+      install : installed_tests_enabled,
-+      name_suffix : module_suffix
-+    )
-+  endforeach
-+endif
- 
- common_c_args = test_cargs + ['-DGLIB_DISABLE_DEPRECATION_WARNINGS']
- common_deps = [libm, thread_dep, libglib_dep]
--- 
-2.37.1
-
diff --git a/pkgs/development/libraries/glibc/locales.nix b/pkgs/development/libraries/glibc/locales.nix
index d2cf0f89cb0..ed6f0a5b32c 100644
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@@ -64,8 +64,9 @@ callPackage ./common.nix { inherit stdenv; } {
 
   installPhase =
     ''
-      mkdir -p "$out/lib/locale"
+      mkdir -p "$out/lib/locale" "$out/share/i18n"
       cp -v "$TMPDIR/$NIX_STORE/"*"/lib/locale/locale-archive" "$out/lib/locale"
+      cp -v ../glibc-2*/localedata/SUPPORTED "$out/share/i18n/SUPPORTED"
     '';
 
   setupHook = writeText "locales-setup-hook.sh"
diff --git a/pkgs/development/libraries/icu/72.nix b/pkgs/development/libraries/icu/72.nix
new file mode 100644
index 00000000000..8eeb10138d1
--- /dev/null
+++ b/pkgs/development/libraries/icu/72.nix
@@ -0,0 +1,4 @@
+import ./base.nix {
+  version = "72.1";
+  sha256 = "sha256-otLTghcJKn7VZjXjRGf5L5drNw4gGCrTJe3qZoGnHWg=";
+}
diff --git a/pkgs/development/libraries/libcamera/default.nix b/pkgs/development/libraries/libcamera/default.nix
index ab2095be8fc..ff7cd7a193e 100644
--- a/pkgs/development/libraries/libcamera/default.nix
+++ b/pkgs/development/libraries/libcamera/default.nix
@@ -19,14 +19,14 @@
 , systemd # for libudev
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "libcamera";
-  version = "unstable-2022-09-15";
+  version = "0.0.1";
 
   src = fetchgit {
     url = "https://git.libcamera.org/libcamera/libcamera.git";
-    rev = "74ab3f778c848b20cbf8fe299170756ff6ebab1a";
-    hash = "sha256-w0I4L6xXTBUdqj30LpVW/KZW6bdoUeoW9lnMOW0OLJY=";
+    rev = "v${version}";
+    hash = "sha256-u5FnfXBCjwSp8QBrH8KIkVGV32/9pff41ZWjWXOwuMI=";
   };
 
   postPatch = ''
@@ -77,6 +77,9 @@ stdenv.mkDerivation {
     "-Dv4l2=true"
     "-Dqcam=disabled"
     "-Dlc-compliance=disabled" # tries unconditionally to download gtest when enabled
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    "-Dwerror=false"
     ];
 
   # Fixes error on a deprecated declaration
@@ -85,6 +88,17 @@ stdenv.mkDerivation {
   # Silence fontconfig warnings about missing config
   FONTCONFIG_FILE = makeFontsConf { fontDirectories = []; };
 
+  # libcamera signs the IPA module libraries at install time, but they are then
+  # modified by stripping and RPATH fixup. Therefore, we need to generate the
+  # signatures again ourselves.
+  #
+  # If this is not done, libcamera will still try to load them, but it will
+  # isolate them in separate processes, which can cause crashes for IPA modules
+  # that are not designed for this (notably ipa_rpi.so).
+  postFixup = ''
+    ../src/ipa/ipa-sign-install.sh src/ipa-priv-key.pem $out/lib/libcamera/ipa_*.so
+  '';
+
   meta = with lib; {
     description = "An open source camera stack and framework for Linux, Android, and ChromeOS";
     homepage = "https://libcamera.org";
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index db5f5026f2c..d4ce1f8bc73 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libxcrypt";
-  version = "4.4.28";
+  version = "4.4.30";
 
   src = fetchurl {
     url = "https://github.com/besser82/libxcrypt/releases/download/v${version}/libxcrypt-${version}.tar.xz";
-    sha256 = "sha256-npNoEfn60R28ozyhm9l8VcUus8oVkB8nreBGzHnmnoc=";
+    sha256 = "sha256-s2Z/C6hdqtavJGukCQ++UxY62TyLaioSV9IqeLt87ro=";
   };
 
   outputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  doCheck = !stdenv.hostPlatform.isMusl;
+  doCheck = true;
 
   passthru.tests = {
     inherit (nixosTests) login shadow;
diff --git a/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch b/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch
deleted file mode 100644
index b0e37e32561..00000000000
--- a/pkgs/development/libraries/openssl/1.1/macos-yosemite-compat.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From cef404f1e7a598166cbc2fd2e0048f7e2d752ad5 Mon Sep 17 00:00:00 2001
-From: David Carlier <devnexen@gmail.com>
-Date: Tue, 24 Aug 2021 22:40:14 +0100
-Subject: [PATCH] Darwin platform allows to build on releases before
- Yosemite/ios 8.
-
-issue #16407 #16408
----
- crypto/rand/rand_unix.c |  5 +----
- include/crypto/rand.h   | 10 ++++++++++
- 2 files changed, 11 insertions(+), 4 deletions(-)
-
-diff --git a/crypto/rand/rand_unix.c b/crypto/rand/rand_unix.c
-index 43f1069d151d..0f4525106af7 100644
---- a/crypto/rand/rand_unix.c
-+++ b/crypto/rand/rand_unix.c
-@@ -34,9 +34,6 @@
- #if defined(__OpenBSD__)
- # include <sys/param.h>
- #endif
--#if defined(__APPLE__)
--# include <CommonCrypto/CommonRandom.h>
--#endif
- 
- #if defined(OPENSSL_SYS_UNIX) || defined(__DJGPP__)
- # include <sys/types.h>
-@@ -381,7 +378,7 @@ static ssize_t syscall_random(void *buf, size_t buflen)
-         if (errno != ENOSYS)
-             return -1;
-     }
--#  elif defined(__APPLE__)
-+#  elif defined(OPENSSL_APPLE_CRYPTO_RANDOM)
-     if (CCRandomGenerateBytes(buf, buflen) == kCCSuccess)
- 	    return (ssize_t)buflen;
- 
-diff --git a/include/crypto/rand.h b/include/crypto/rand.h
-index 5350d3a93119..674f840fd13c 100644
---- a/include/crypto/rand.h
-+++ b/include/crypto/rand.h
-@@ -20,6 +20,16 @@
- 
- # include <openssl/rand.h>
- 
-+# if defined(__APPLE__) && !defined(OPENSSL_NO_APPLE_CRYPTO_RANDOM)
-+#  include <Availability.h>
-+#  if (defined(__MAC_OS_X_VERSION_MIN_REQUIRED) && __MAC_OS_X_VERSION_MIN_REQUIRED >= 101000) || \
-+     (defined(__IPHONE_OS_VERSION_MIN_REQUIRED) && __IPHONE_OS_VERSION_MIN_REQUIRED >= 80000)
-+#   define OPENSSL_APPLE_CRYPTO_RANDOM 1
-+#   include <CommonCrypto/CommonCryptoError.h>
-+#   include <CommonCrypto/CommonRandom.h>
-+#  endif
-+# endif
-+
- /* forward declaration */
- typedef struct rand_pool_st RAND_POOL;
- 
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index 62cc8e24f41..9acbca259c6 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -214,17 +214,15 @@ let
 in {
 
 
-  openssl_1_1 = common rec {
-    version = "1.1.1q";
-    sha256 = "sha256-15Oc5hQCnN/wtsIPDi5XAxWKSJpyslB7i9Ub+Mj9EMo=";
+  openssl_1_1 = common {
+    version = "1.1.1s";
+    sha256 = "sha256-xawB52Dub/Dath1rK70wFGck0GPrMiGAxvGKb3Tktqo=";
     patches = [
       ./1.1/nix-ssl-cert-file.patch
 
       (if stdenv.hostPlatform.isDarwin
        then ./use-etc-ssl-certs-darwin.patch
        else ./use-etc-ssl-certs.patch)
-    ] ++ lib.optionals (stdenv.isDarwin && (builtins.substring 5 5 version) < "m") [
-      ./1.1/macos-yosemite-compat.patch
     ];
     withDocs = true;
   };
diff --git a/pkgs/development/libraries/pixman/default.nix b/pkgs/development/libraries/pixman/default.nix
index ffdaeaef035..49f5fbe8815 100644
--- a/pkgs/development/libraries/pixman/default.nix
+++ b/pkgs/development/libraries/pixman/default.nix
@@ -2,11 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "pixman";
-  version = "0.38.4";
+  version = "0.42.2";
 
   src = fetchurl {
-    url = "mirror://xorg/individual/lib/${pname}-${version}.tar.bz2";
-    sha256 = "0l0m48lnmdlmnaxn2021qi5cj366d9fzfjxkqgcj9bs14pxbgaw4";
+    urls = [
+      "mirror://xorg/individual/lib/${pname}-${version}.tar.gz"
+      "https://cairographics.org/releases/${pname}-${version}.tar.gz"
+    ];
+    hash = "sha256-6hSA762i/ZSLx1Nm98NJ4cltMpfQmj/mJibjjiNKYl4=";
   };
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 5d7b7202945..a93c2b67d43 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -81,7 +81,11 @@ let
         sha256 = "0crkw3j1iwdc1pbf5dhar0b4q3h5gs2q1sika8m12y02yk3ns697";
       })
     ];
-    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtdeclarative = [
+      ./qtdeclarative.patch
+      # prevent headaches from stale qmlcache data
+      ./qtdeclarative-default-disable-qmlcache.patch
+    ];
     qtlocation = [ ./qtlocation-gcc-9.patch ];
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
diff --git a/pkgs/development/libraries/qt-5/5.12/qtdeclarative-default-disable-qmlcache.patch b/pkgs/development/libraries/qt-5/5.12/qtdeclarative-default-disable-qmlcache.patch
new file mode 100644
index 00000000000..e9c3b7e2284
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.12/qtdeclarative-default-disable-qmlcache.patch
@@ -0,0 +1,40 @@
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 9e5bc0b0..9219def6 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
++++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -2151,7 +2151,7 @@ void QQmlTypeData::unregisterCallback(TypeDataCallback *callback)
+ 
+ bool QQmlTypeData::tryLoadFromDiskCache()
+ {
+-    if (disableDiskCache() && !forceDiskCache())
++    if (!forceDiskCache())
+         return false;
+ 
+     if (isDebugging())
+@@ -2658,7 +2658,7 @@ void QQmlTypeData::compile(const QQmlRefPointer<QQmlTypeNameCache> &typeNameCach
+         return;
+     }
+ 
+-    const bool trySaveToDisk = (!disableDiskCache() || forceDiskCache()) && !m_document->jsModule.debugMode && !typeRecompilation;
++    const bool trySaveToDisk = (forceDiskCache()) && !m_document->jsModule.debugMode && !typeRecompilation;
+     if (trySaveToDisk) {
+         QString errorString;
+         if (m_compiledData->saveToDisk(url(), &errorString)) {
+@@ -3014,7 +3014,7 @@ QQmlRefPointer<QQmlScriptData> QQmlScriptBlob::scriptData() const
+ 
+ void QQmlScriptBlob::dataReceived(const SourceCodeData &data)
+ {
+-    if (!disableDiskCache() || forceDiskCache()) {
++    if (forceDiskCache()) {
+         QQmlRefPointer<QV4::CompiledData::CompilationUnit> unit = QV4::Compiler::Codegen::createUnitForLoading();
+         QString error;
+         if (unit->loadFromDisk(url(), data.sourceTimeStamp(), &error)) {
+@@ -3077,7 +3077,7 @@ void QQmlScriptBlob::dataReceived(const SourceCodeData &data)
+         qmlGenerator.generate(irUnit);
+     }
+ 
+-    if ((!disableDiskCache() || forceDiskCache()) && !isDebugging()) {
++    if ((forceDiskCache()) && !isDebugging()) {
+         QString errorString;
+         if (unit->saveToDisk(url(), &errorString)) {
+             QString error;
diff --git a/pkgs/development/libraries/qt-5/5.14/default.nix b/pkgs/development/libraries/qt-5/5.14/default.nix
index 32630810b49..808562772f9 100644
--- a/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/pkgs/development/libraries/qt-5/5.14/default.nix
@@ -68,7 +68,11 @@ let
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
     ];
-    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtdeclarative = [
+      ./qtdeclarative.patch
+      # prevent headaches from stale qmlcache data
+      ./qtdeclarative-default-disable-qmlcache.patch
+    ];
     qtlocation = [ ./qtlocation-gcc-9.patch ];
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
diff --git a/pkgs/development/libraries/qt-5/5.14/qtdeclarative-default-disable-qmlcache.patch b/pkgs/development/libraries/qt-5/5.14/qtdeclarative-default-disable-qmlcache.patch
new file mode 100644
index 00000000000..8ef5ef53dea
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.14/qtdeclarative-default-disable-qmlcache.patch
@@ -0,0 +1,13 @@
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 6c12de92..fc67dc07 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
++++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -705,7 +705,7 @@ bool QQmlTypeLoader::Blob::isDebugging() const
+ 
+ bool QQmlTypeLoader::Blob::diskCacheEnabled() const
+ {
+-    return (!disableDiskCache() || forceDiskCache()) && !isDebugging();
++    return (forceDiskCache()) && !isDebugging();
+ }
+ 
+ bool QQmlTypeLoader::Blob::qmldirDataAvailable(const QQmlRefPointer<QQmlQmldirData> &data, QList<QQmlError> *errors)
diff --git a/pkgs/development/libraries/qt-5/5.15/default.nix b/pkgs/development/libraries/qt-5/5.15/default.nix
index e3f94ba8ffe..616bf22ff13 100644
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -56,7 +56,11 @@ let
       ./qtbase.patch.d/0010-qtbase-assert.patch
       ./qtbase.patch.d/0011-fix-header_module.patch
     ];
-    qtdeclarative = [ ./qtdeclarative.patch ];
+    qtdeclarative = [
+      ./qtdeclarative.patch
+      # prevent headaches from stale qmlcache data
+      ./qtdeclarative-default-disable-qmlcache.patch
+    ];
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
     qtwebengine = lib.optionals stdenv.isDarwin [
diff --git a/pkgs/development/libraries/qt-5/5.15/qtdeclarative-default-disable-qmlcache.patch b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-default-disable-qmlcache.patch
new file mode 100644
index 00000000000..03668d960c7
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.15/qtdeclarative-default-disable-qmlcache.patch
@@ -0,0 +1,13 @@
+diff --git a/src/qml/qml/qqmltypeloader.cpp b/src/qml/qml/qqmltypeloader.cpp
+index 1d66e75..827567a 100644
+--- a/src/qml/qml/qqmltypeloader.cpp
++++ b/src/qml/qml/qqmltypeloader.cpp
+@@ -727,7 +727,7 @@ bool QQmlTypeLoader::Blob::isDebugging() const
+ 
+ bool QQmlTypeLoader::Blob::diskCacheEnabled() const
+ {
+-    return (!disableDiskCache() && !isDebugging()) || forceDiskCache();
++    return forceDiskCache();
+ }
+ 
+ bool QQmlTypeLoader::Blob::qmldirDataAvailable(const QQmlRefPointer<QQmlQmldirData> &data, QList<QQmlError> *errors)
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
index c8abc71a223..76231f866ef 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative.nix
@@ -16,6 +16,10 @@ qtModule {
     "-DQT6_INSTALL_PREFIX=${placeholder "out"}"
     "-DQT_INSTALL_PREFIX=${placeholder "out"}"
   ];
+  patches = [
+    # prevent headaches from stale qmlcache data
+    ../patches/qtdeclarative-default-disable-qmlcache.patch
+  ];
   postInstall = ''
     substituteInPlace "$out/lib/cmake/Qt6Qml/Qt6QmlMacros.cmake" \
       --replace ''\'''${QT6_INSTALL_PREFIX}' "$dev"
diff --git a/pkgs/development/libraries/qt-6/patches/qtdeclarative-default-disable-qmlcache.patch b/pkgs/development/libraries/qt-6/patches/qtdeclarative-default-disable-qmlcache.patch
new file mode 100644
index 00000000000..02e578f2d52
--- /dev/null
+++ b/pkgs/development/libraries/qt-6/patches/qtdeclarative-default-disable-qmlcache.patch
@@ -0,0 +1,13 @@
+diff --git a/src/qml/jsruntime/qv4engine.cpp b/src/qml/jsruntime/qv4engine.cpp
+index 852cde9e..165f1b57 100644
+--- a/src/qml/jsruntime/qv4engine.cpp
++++ b/src/qml/jsruntime/qv4engine.cpp
+@@ -2093,7 +2093,7 @@ void ExecutionEngine::registerModule(const QString &_name, const QJSValue &modul
+ 
+ bool ExecutionEngine::diskCacheEnabled() const
+ {
+-    return (!disableDiskCache() && !debugger()) || forceDiskCache();
++    return forceDiskCache();
+ }
+ 
+ void ExecutionEngine::callInContext(QV4::Function *function, QObject *self,
diff --git a/pkgs/development/libraries/taglib/default.nix b/pkgs/development/libraries/taglib/default.nix
index 666d013adeb..0fb207e4e0f 100644
--- a/pkgs/development/libraries/taglib/default.nix
+++ b/pkgs/development/libraries/taglib/default.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "taglib";
-  version = "1.12";
+  version = "1.13";
 
   src = fetchFromGitHub {
     owner = "taglib";
     repo = "taglib";
     rev = "v${version}";
-    sha256 = "sha256-omErajnYgxbflsbe6pS2KsexZcXisso0WGYnmIud7WA=";
+    sha256 = "sha256-DRALRH+/7c2lBvCpLp8hop3Xxsf76F1q8L7F9qehqQA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/tracker/default.nix b/pkgs/development/libraries/tracker/default.nix
index 2c4422d7a1f..40744f987c8 100644
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tracker";
-  version = "3.4.0";
+  version = "3.4.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "s7OAyVcdfHQjtfQB5KLy143kcUOwNessEoHiQjxZIYs=";
+    sha256 = "6p1BqfucK0KtgPwsgjJ7XHE9WUyWmwnhpJvmP7dPT64=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/Cython/default.nix b/pkgs/development/python-modules/Cython/default.nix
index 4a6c14b5709..3065e822f6b 100644
--- a/pkgs/development/python-modules/Cython/default.nix
+++ b/pkgs/development/python-modules/Cython/default.nix
@@ -48,8 +48,20 @@ in buildPythonPackage rec {
     # trashcan support is needed to avoid stack overflows during object deallocation in sage (https://trac.sagemath.org/ticket/27267)
     (fetchpatch {
       name = "trashcan.patch";
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/cython/patches/trashcan.patch?id=4569a839f070a1a38d5dbce2a4d19233d25aeed2";
-      sha256 = "sha256-+pOF1XNTEtNseLpqPzrc1Jfwt5hGx7doUoccIhNneYY=";
+      url = "https://github.com/cython/cython/commit/f781880b6780117660b2026caadf4a6d7905722f.patch";
+      sha256 = "sha256-SnjaJdBZxm3O5gJ5Dxut6+eeVtZv+ygUUNwAwgoiFxg=";
+    })
+    # The above commit introduces custom trashcan macros, as well as
+    # compiler changes to use them in Cython-emitted code. The latter
+    # change is still useful, but the former has been upstreamed as of
+    # Python 3.8, and the patch below makes Cython use the upstream
+    # trashcan macros whenever available. This is needed for Python
+    # 3.11 support, because the API used in Cython's implementation
+    # changed: https://github.com/cython/cython/pull/4475
+    (fetchpatch {
+      name = "disable-trashcan.patch";
+      url = "https://github.com/cython/cython/commit/e337825cdcf5e94d38ba06a0cb0188e99ce0cc92.patch";
+      sha256 = "sha256-q0f63eetKrDpmP5Z4v8EuGxg26heSyp/62OYqhRoSso=";
     })
   ];
 
diff --git a/pkgs/development/python-modules/build/default.nix b/pkgs/development/python-modules/build/default.nix
index 1ef401b8c0a..efc1f2f45ad 100644
--- a/pkgs/development/python-modules/build/default.nix
+++ b/pkgs/development/python-modules/build/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "build";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "pypa";
     repo = pname;
     rev = version;
-    hash = "sha256-P0DFBYsL2Ce/JwfYss64+CY/IvzYZEiz9wuEslij+oU=";
+    hash = "sha256-iQvfZC/h9SbagExoG8dJ2A8G8gVRdMaRvEy9QcQIN5I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/cattrs/default.nix b/pkgs/development/python-modules/cattrs/default.nix
index 6584f5f15df..8514190202e 100644
--- a/pkgs/development/python-modules/cattrs/default.nix
+++ b/pkgs/development/python-modules/cattrs/default.nix
@@ -2,7 +2,6 @@
 , attrs
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , exceptiongroup
 , hypothesis
 , immutables
@@ -21,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "cattrs";
-  version = "22.1.0";
+  version = "22.2.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -30,17 +29,9 @@ buildPythonPackage rec {
     owner = "python-attrs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-C8uIsewpgJfB1yYckWTwF5K32+2AAOrxFKB9I18RENg=";
+    hash = "sha256-Qnrq/mIA/t0mur6IAen4vTmMIhILWS6v5nuf+Via2hA=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/python-attrs/cattrs/commit/290d162a589acf10ea63b825b7b283e23ca7698a.diff";
-      excludes = [ "poetry.lock" ];
-      hash = "sha256-n6c3qVg9umGKAxeTALq3QTJgO9DIj3SY0ZHhtsDeW94=";
-    })
-  ];
-
   nativeBuildInputs = [
     poetry-core
   ];
diff --git a/pkgs/development/python-modules/exceptiongroup/default.nix b/pkgs/development/python-modules/exceptiongroup/default.nix
index 1475b44e001..76c6f0e2d34 100644
--- a/pkgs/development/python-modules/exceptiongroup/default.nix
+++ b/pkgs/development/python-modules/exceptiongroup/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "exceptiongroup";
-  version = "1.0.0rc9";
+  version = "1.0.0";
   format = "flit";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kIakoh75sxxyGBx3wECgdLoIie5Wp7KJ/wr7DZdlX5Y=";
+    hash = "sha256-r/ur8T+26YmIw42cVlDnAVaf48HeMjPPthxfM3dGkK0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/psutil/default.nix b/pkgs/development/python-modules/psutil/default.nix
index 088541552ec..b461bc6fdcf 100644
--- a/pkgs/development/python-modules/psutil/default.nix
+++ b/pkgs/development/python-modules/psutil/default.nix
@@ -1,29 +1,42 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, isPy27, python
-, CoreFoundation, IOKit
+{ lib
+, stdenv
+, buildPythonPackage
+, CoreFoundation
+, fetchPypi
+, IOKit
 , pytestCheckHook
-, mock
-, unittest2
+, python
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "psutil";
-  version = "5.9.2";
+  version = "5.9.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-/rhhoQtsO7AHAQY7N+Svx1T4IX8PCcQigFhr1qxxK1w=";
+    hash = "sha256-fM/N/qT8SwoCyiwx3n/NGGvrnP+CB4AOFKtm95x3OvY=";
   };
 
-  # We have many test failures on various parts of the package:
-  #  - segfaults on darwin:
-  #    https://github.com/giampaolo/psutil/issues/1715
-  #  - swap (on linux) might cause test failures if it is fully used:
-  #    https://github.com/giampaolo/psutil/issues/1911
-  #  - some mount paths are required in the build sanbox to make the tests succeed:
-  #    https://github.com/giampaolo/psutil/issues/1912
-  doCheck = false;
-  checkInputs = [ pytestCheckHook ]
-  ++ lib.optionals isPy27 [ mock unittest2 ];
+  buildInputs =
+    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
+    lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+      CoreFoundation
+    ] ++ lib.optionals stdenv.isDarwin [
+      IOKit
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # Segfaults on darwin:
+  # https://github.com/giampaolo/psutil/issues/1715
+  doCheck = !stdenv.isDarwin;
+
   # In addition to the issues listed above there are some that occure due to
   # our sandboxing which we can work around by disabling some tests:
   # - cpu_times was flaky on darwin
@@ -34,22 +47,19 @@ buildPythonPackage rec {
 
   # Note: $out must be referenced as test import paths are relative
   disabledTests = [
-    "user"
+    "cpu_freq"
+    "cpu_times"
     "disk_io_counters"
     "sensors_battery"
-    "cpu_times"
-    "cpu_freq"
+    "user"
   ];
 
-  buildInputs =
-    # workaround for https://github.com/NixOS/nixpkgs/issues/146760
-    lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ CoreFoundation ] ++
-    lib.optionals stdenv.isDarwin [ IOKit ];
-
-  pythonImportsCheck = [ "psutil" ];
+  pythonImportsCheck = [
+    "psutil"
+  ];
 
   meta = with lib; {
-    description = "Process and system utilization information interface for python";
+    description = "Process and system utilization information interface";
     homepage = "https://github.com/giampaolo/psutil";
     license = licenses.bsd3;
     maintainers = with maintainers; [ jonringer ];
diff --git a/pkgs/development/python-modules/py-cpuinfo/default.nix b/pkgs/development/python-modules/py-cpuinfo/default.nix
index 12b9668f1ed..09f8ba4ad75 100644
--- a/pkgs/development/python-modules/py-cpuinfo/default.nix
+++ b/pkgs/development/python-modules/py-cpuinfo/default.nix
@@ -1,20 +1,24 @@
 { lib
 , stdenv
-, fetchFromGitHub
 , buildPythonPackage
+, fetchFromGitHub
 , pytestCheckHook
+, pythonOlder
 , sysctl
 }:
 
 buildPythonPackage rec {
   pname = "py-cpuinfo";
-  version = "8.0.0";
+  version = "9.0.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
      owner = "workhorsy";
      repo = pname;
      rev = "v${version}";
-     sha256 = "sha256-Mgzj1HTasUNHeHMVwV6d+TeyVqnBNUwCJ1EC3kfovf8=";
+     hash = "sha256-Q5u0guAqDVhf6bvJTzNvCpWbIzjxxAjE7s0OuXj9T4Q=";
   };
 
   checkInputs = [
@@ -28,7 +32,9 @@ buildPythonPackage rec {
       --replace "_run_and_get_stdout(['sysctl'" "_run_and_get_stdout(['${sysctl}/bin/sysctl'"
   '';
 
-  pythonImportsCheck = [ "cpuinfo" ];
+  pythonImportsCheck = [
+    "cpuinfo"
+  ];
 
   meta = with lib; {
     description = "Get CPU info with pure Python";
diff --git a/pkgs/development/python-modules/pymemcache/default.nix b/pkgs/development/python-modules/pymemcache/default.nix
index c9d3ef94d77..594964e6649 100644
--- a/pkgs/development/python-modules/pymemcache/default.nix
+++ b/pkgs/development/python-modules/pymemcache/default.nix
@@ -1,15 +1,17 @@
 { lib
 , buildPythonPackage
+, faker
 , fetchFromGitHub
 , mock
 , six
 , pytestCheckHook
 , pythonOlder
+, zstd
 }:
 
 buildPythonPackage rec {
   pname = "pymemcache";
-  version = "3.5.2";
+  version = "4.0.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +20,7 @@ buildPythonPackage rec {
     owner = "pinterest";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-bsiFWZHGJO/07w6mFXzf0JwftJWClE2mTv86h8zT1K0=";
+    hash = "sha256-WgtHhp7lE6StoOBfSy9+v3ODe/+zUC7lGrc2S4M68+M=";
   };
 
   propagatedBuildInputs = [
@@ -26,8 +28,10 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    faker
     mock
     pytestCheckHook
+    zstd
   ];
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytest-datadir/default.nix b/pkgs/development/python-modules/pytest-datadir/default.nix
index d53734618b3..58ad575d638 100644
--- a/pkgs/development/python-modules/pytest-datadir/default.nix
+++ b/pkgs/development/python-modules/pytest-datadir/default.nix
@@ -1,31 +1,30 @@
-{ lib, buildPythonPackage, fetchFromGitHub
-, setuptools-scm, pytest
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "pytest-datadir";
-  version = "1.3.1";
+  version = "1.4.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "gabrielcnr";
-    repo = pname;
-    rev = version;
-    sha256 = "0kwgp6sqnqnmww5r0dkmyfpi0lmw0iwxz3fnwn2fs8w6bvixzznf";
+    repo = "pytest-datadir";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-HyJ0rU1nHqRv8SHFS8m3GZ5409+JZIkoDgIVjy4ol54=";
   };
 
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
   nativeBuildInputs = [ setuptools-scm ];
-
-  preBuild = ''
-    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
-  '';
-
-  checkInputs = [ pytest ];
-  checkPhase = "pytest";
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "pytest_datadir" ];
 
   meta = with lib; {
+    description = "Pytest plugin for manipulating test data directories and files";
     homepage = "https://github.com/gabrielcnr/pytest-datadir";
-    description = "pytest plugin for manipulating test data directories and files";
     license = licenses.mit;
     maintainers = with maintainers; [ kira-bruneau ];
   };
diff --git a/pkgs/development/python-modules/pytest-subtests/default.nix b/pkgs/development/python-modules/pytest-subtests/default.nix
index 4b88991bb74..8ada20dce8f 100644
--- a/pkgs/development/python-modules/pytest-subtests/default.nix
+++ b/pkgs/development/python-modules/pytest-subtests/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pytest-subtests";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Rus3YCLpJpUIFszCNQLeMnetzBOWZS3bMyjOAokFLE0=";
+    sha256 = "sha256-wDF81fal6z6Vfonb5PwzIqmv3botuEFDVe0qLLkahE4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/requests-cache/default.nix b/pkgs/development/python-modules/requests-cache/default.nix
index 45b03feb461..21648484b2f 100644
--- a/pkgs/development/python-modules/requests-cache/default.nix
+++ b/pkgs/development/python-modules/requests-cache/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage rec {
   pname = "requests-cache";
-  version = "0.9.6";
+  version = "0.9.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -35,7 +35,7 @@ buildPythonPackage rec {
     owner = "requests-cache";
     repo = "requests-cache";
     rev = "v${version}";
-    hash = "sha256-oFI5Rv/MAiPHiZts0PrNS+YMDFD/RxnMJ6deTxZNkSM=";
+    hash = "sha256-HSYu4jOEMXI/zGuWI7invYVvVeeM5+dDlc+9h8TOGms=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ruamel-yaml-clib/default.nix b/pkgs/development/python-modules/ruamel-yaml-clib/default.nix
index 143452274ab..a8f93d53f6f 100644
--- a/pkgs/development/python-modules/ruamel-yaml-clib/default.nix
+++ b/pkgs/development/python-modules/ruamel-yaml-clib/default.nix
@@ -5,19 +5,19 @@
 
 buildPythonPackage rec {
   pname = "ruamel-yaml-clib";
-  version = "0.2.6";
+  version = "0.2.7";
   format = "setuptools";
 
   src = fetchhg {
     url = "http://hg.code.sf.net/p/ruamel-yaml-clib/code";
     rev = version;
-    sha256 = "sha256-mpkh9JhYKRX47jfKprjt1Vpm9DMz8LcWzkotJ+/xoxY=";
+    sha256 = "sha256-QNJyJWfCT8zEvrqI65zPlWIMSRZSoDwIAbFU48TfO4U=";
   };
 
   # no tests
   doCheck = false;
 
-  # circular depedency with ruamel-yaml
+  # circular dependency with ruamel-yaml
   # pythonImportsCheck = [ "_ruamel_yaml" ];
 
   meta = with lib; {
diff --git a/pkgs/development/ruby-modules/with-packages/Gemfile b/pkgs/development/ruby-modules/with-packages/Gemfile
index d0c27c63858..f11828cb835 100644
--- a/pkgs/development/ruby-modules/with-packages/Gemfile
+++ b/pkgs/development/ruby-modules/with-packages/Gemfile
@@ -77,6 +77,7 @@ gem 'iconv'
 gem 'idn-ruby'
 gem 'jbuilder'
 gem 'jekyll'
+gem 'jekyll-favicon'
 gem 'jmespath'
 gem 'jwt'
 gem 'kramdown-rfc2629'
diff --git a/pkgs/development/tools/build-managers/cmake/001-search-path.diff b/pkgs/development/tools/build-managers/cmake/001-search-path.diff
index 607668b1315..04ab0847a70 100644
--- a/pkgs/development/tools/build-managers/cmake/001-search-path.diff
+++ b/pkgs/development/tools/build-managers/cmake/001-search-path.diff
@@ -12,7 +12,7 @@ index b9381c3d7d..5e944640b5 100644
    # CMake install location
    "${_CMAKE_INSTALL_DIR}"
    )
-@@ -47,48 +44,48 @@ endif()
+@@ -47,48 +44,49 @@ endif()
  
  # Non "standard" but common install prefixes
  list(APPEND CMAKE_SYSTEM_PREFIX_PATH
@@ -22,9 +22,10 @@ index b9381c3d7d..5e944640b5 100644
    )
  
  # List common include file locations not under the common prefixes.
-+if(IS_DIRECTORY $ENV{NIX_CC}
-+  AND EXISTS $ENV{NIX_CC}/nix-support/orig-libc
-+  AND EXISTS $ENV{NIX_CC}/nix-support/orig-libc-dev)
++if(DEFINED ENV{NIX_CC}
++  AND IS_DIRECTORY "$ENV{NIX_CC}"
++  AND EXISTS "$ENV{NIX_CC}/nix-support/orig-libc"
++  AND EXISTS "$ENV{NIX_CC}/nix-support/orig-libc-dev")
 +  file(STRINGS "$ENV{NIX_CC}/nix-support/orig-libc" _nix_cmake_libc)
 +  file(STRINGS "$ENV{NIX_CC}/nix-support/orig-libc-dev" _nix_cmake_libc_dev)
 +else()
diff --git a/pkgs/development/tools/build-managers/meson/default.nix b/pkgs/development/tools/build-managers/meson/default.nix
index 866fa303148..9fef483ff0e 100644
--- a/pkgs/development/tools/build-managers/meson/default.nix
+++ b/pkgs/development/tools/build-managers/meson/default.nix
@@ -5,7 +5,6 @@
 , pkg-config
 , python3
 , substituteAll
-, withDarwinFrameworksGtkDocPatch ? false
 }:
 
 python3.pkgs.buildPythonApplication rec {
diff --git a/pkgs/development/tools/misc/cvise/default.nix b/pkgs/development/tools/misc/cvise/default.nix
index cd3a38d300e..ae0846f479c 100644
--- a/pkgs/development/tools/misc/cvise/default.nix
+++ b/pkgs/development/tools/misc/cvise/default.nix
@@ -32,6 +32,11 @@ buildPythonApplication rec {
   ];
 
   postPatch = ''
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    substituteInPlace CMakeLists.txt \
+      --replace " -Werror " " "
+
     # 'cvise --command=...' generates a script with hardcoded shebang.
     substituteInPlace cvise.py \
       --replace "#!/bin/bash" "#!${bash}/bin/bash"
diff --git a/pkgs/development/tools/misc/elfutils/default.nix b/pkgs/development/tools/misc/elfutils/default.nix
index 60afcbf258a..87271cf50ff 100644
--- a/pkgs/development/tools/misc/elfutils/default.nix
+++ b/pkgs/development/tools/misc/elfutils/default.nix
@@ -8,11 +8,11 @@
 # TODO: Look at the hardcoded paths to kernel, modules etc.
 stdenv.mkDerivation rec {
   pname = "elfutils";
-  version = "0.187";
+  version = "0.188";
 
   src = fetchurl {
     url = "https://sourceware.org/elfutils/ftp/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-5wsN++YQ+QxNH+DXGvFCpOJcPE7566uNLXK2UVnUVMg=";
+    sha256 = "sha256-+4sOjQgCAFuaMJxgwdjeMt0pUbVvDDo8tW0hzgFZXf8=";
   };
 
   patches = [
diff --git a/pkgs/development/tools/spirv-tools/default.nix b/pkgs/development/tools/spirv-tools/default.nix
index 2ac91924feb..3a64646ded6 100644
--- a/pkgs/development/tools/spirv-tools/default.nix
+++ b/pkgs/development/tools/spirv-tools/default.nix
@@ -15,7 +15,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake python3 ];
 
-  cmakeFlags = [ "-DSPIRV-Headers_SOURCE_DIR=${spirv-headers.src}" ];
+  cmakeFlags = [
+    "-DSPIRV-Headers_SOURCE_DIR=${spirv-headers.src}"
+    # Avoid blanket -Werror to evade build failures on less
+    # tested compilers.
+    "-DSPIRV_WERROR=OFF"
+  ];
 
   # https://github.com/KhronosGroup/SPIRV-Tools/issues/3905
   postPatch = ''
diff --git a/pkgs/development/tools/xcbuild/wrapper.nix b/pkgs/development/tools/xcbuild/wrapper.nix
index cefda47cb5b..2dbea4e3833 100644
--- a/pkgs/development/tools/xcbuild/wrapper.nix
+++ b/pkgs/development/tools/xcbuild/wrapper.nix
@@ -1,6 +1,5 @@
-{ lib, stdenv, makeWrapper, writeText, writeShellScriptBin, runCommand
+{ lib, stdenv, makeWrapper, writeText, writeTextFile, runCommand, callPackage
 , CoreServices, ImageIO, CoreGraphics
-, runtimeShell, callPackage
 , xcodePlatform ? stdenv.targetPlatform.xcodePlatform or "MacOSX"
 , xcodeVer ? stdenv.targetPlatform.xcodeVer or "9.4.1"
 , sdkVer ? stdenv.targetPlatform.darwinSdkVersion or "10.12" }:
@@ -37,7 +36,7 @@ let
   '';
 
   xcode-select = writeText "xcode-select" ''
-#!${runtimeShell}
+#!${stdenv.shell}
 while [ $# -gt 0 ]; do
    case "$1" in
          -h | --help) ;; # noop
@@ -51,7 +50,12 @@ while [ $# -gt 0 ]; do
 done
   '';
 
-  xcrun = writeShellScriptBin "xcrun" ''
+  xcrun = writeTextFile {
+    name = "xcrun";
+    executable = true;
+    destination = "/bin/xcrun";
+    text = ''
+#!${stdenv.shell}
 args=( "$@" )
 
 # If an SDK was requested, check that it matches.
@@ -94,7 +98,11 @@ done
 if ! [[ -z "$@" ]]; then
    exec "$@"
 fi
-  '';
+    '';
+    checkPhase = ''
+      ${stdenv.shellDryRun} "$target"
+    '';
+  };
 
 in
 
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index f9aa1880104..d046c8c7d19 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -379,6 +379,7 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
     "O=$(buildRoot)"
     "CC=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     "HOSTCC=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
+    "HOSTLD=${buildPackages.stdenv.cc.bintools}/bin/${buildPackages.stdenv.cc.targetPrefix}ld"
     "ARCH=${stdenv.hostPlatform.linuxArch}"
   ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 5e5a758f302..47dbbb21db3 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -122,7 +122,7 @@ assert withHomed -> withCryptsetup;
 let
   wantCurl = withRemote || withImportd;
   wantGcrypt = withResolved || withImportd;
-  version = "251.5";
+  version = "251.7";
 
   # Bump this variable on every (major) version change. See below (in the meson options list) for why.
   # command:
@@ -139,7 +139,7 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "sha256-2MEmvFT1D+9v8OazBwjnKc7i/x7i196Eoi8bODk1cM4=";
+    sha256 = "sha256-Sa5diyNFyYtREo1xSCcufAW83ZZGZvueoDVuQ2r8wno=";
   };
 
   # On major changes, or when otherwise required, you *must* reformat the patches,
@@ -243,12 +243,14 @@ stdenv.mkDerivation {
           opt = condition: pkg: if condition then pkg else null;
         in
         [
-          # bpf compilation support
-          { name = "libbpf.so.0"; pkg = opt withLibBPF libbpf; }
+          # bpf compilation support. We use libbpf 1 now.
+          { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
+          { name = "libbpf.so.0"; pkg = null; }
 
           # We did never provide support for libxkbcommon & qrencode
           { name = "libxkbcommon.so.0"; pkg = null; }
           { name = "libqrencode.so.4"; pkg = null; }
+          { name = "libqrencode.so.3"; pkg = null; }
 
           # We did not provide libpwquality before so it is safe to disable it for
           # now.
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index e261409d7d2..5ac7967c60f 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -225,7 +225,7 @@ self: super:
 
   libXi = super.libXi.overrideAttrs (attrs: {
     outputs = [ "out" "dev" "man" "doc" ];
-    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXfixes ];
+    propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ self.libXfixes self.libXext ];
     configureFlags = lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       "xorg_cv_malloc0_returns_null=no"
     ] ++ lib.optional stdenv.hostPlatform.isStatic "--disable-shared";
diff --git a/pkgs/tools/misc/calamares-nixos-extensions/default.nix b/pkgs/tools/misc/calamares-nixos-extensions/default.nix
index a587cd585e1..ad21c398fe9 100644
--- a/pkgs/tools/misc/calamares-nixos-extensions/default.nix
+++ b/pkgs/tools/misc/calamares-nixos-extensions/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "calamares-nixos-extensions";
-  version = "0.3.10";
+  version = "0.3.11";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "calamares-nixos-extensions";
     rev = version;
-    sha256 = "YJyK0rsrftrCwYD+aCAkPe/kAqUXsP/4WBAGtNKIGj8=";
+    sha256 = "NAHUU0tQLu8c2dke1V0aM3mHrNgM8ekHSB2Fo9dQUk8=";
   };
 
   installPhase = ''
diff --git a/pkgs/tools/misc/calamares/default.nix b/pkgs/tools/misc/calamares/default.nix
index 22b5cde7f45..34d05852a7e 100644
--- a/pkgs/tools/misc/calamares/default.nix
+++ b/pkgs/tools/misc/calamares/default.nix
@@ -36,6 +36,8 @@ mkDerivation rec {
     # Fix setting the kayboard layout on GNOME wayland
     # By default the module uses the setxkbmap, which will not change the keyboard
     ./waylandkbd.patch
+    # Change default location where calamares searches for locales
+    ./supportedlocale.patch
   ];
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];
diff --git a/pkgs/tools/misc/calamares/supportedlocale.patch b/pkgs/tools/misc/calamares/supportedlocale.patch
new file mode 100644
index 00000000000..ab161ffdee7
--- /dev/null
+++ b/pkgs/tools/misc/calamares/supportedlocale.patch
@@ -0,0 +1,13 @@
+diff --git a/src/modules/locale/Config.cpp b/src/modules/locale/Config.cpp
+index 2357019a7..75b547430 100644
+--- a/src/modules/locale/Config.cpp
++++ b/src/modules/locale/Config.cpp
+@@ -48,7 +48,7 @@ loadLocales( const QString& localeGenPath )
+     // supported locales. We first try that one, and if it doesn't exist, we fall back
+     // to parsing the lines from locale.gen
+     localeGenLines.clear();
+-    QFile supported( "/usr/share/i18n/SUPPORTED" );
++    QFile supported( "/run/current-system/sw/share/i18n/SUPPORTED" );
+     QByteArray ba;
+ 
+     if ( supported.exists() && supported.open( QIODevice::ReadOnly | QIODevice::Text ) )
diff --git a/pkgs/tools/misc/libcpuid/default.nix b/pkgs/tools/misc/libcpuid/default.nix
index e7fb2b4da79..83f42dabebe 100644
--- a/pkgs/tools/misc/libcpuid/default.nix
+++ b/pkgs/tools/misc/libcpuid/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcpuid";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "anrieff";
     repo = "libcpuid";
     rev = "v${version}";
-    sha256 = "sha256-XX+XFd1ehahIUGONAx2iOxetU0s6vONc7m91zEOWz5o=";
+    sha256 = "sha256-KxG06a56XPa34IJGAJbBeHUKkCEba+R7HOSosTCwQKU=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://libcpuid.sourceforge.net/";
     description = "A small C library for x86 CPU detection and feature extraction";
+    changelog = "https://raw.githubusercontent.com/anrieff/libcpuid/master/ChangeLog";
     license = licenses.bsd2;
     maintainers = with maintainers; [ orivej artuuge ];
     platforms = platforms.x86;
diff --git a/pkgs/tools/networking/inetutils/default.nix b/pkgs/tools/networking/inetutils/default.nix
index c6362f54469..57ed93d8130 100644
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@@ -1,14 +1,14 @@
 { stdenv, lib, fetchurl, ncurses, perl, help2man
-, apparmorRulesFromClosure, fetchpatch
+, apparmorRulesFromClosure
 }:
 
 stdenv.mkDerivation rec {
   pname = "inetutils";
-  version = "2.3";
+  version = "2.4";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-CwG7COKWI8TjuUDyM8lhRR2a+MUGYwGt12pSqV1Rdyw=";
+    sha256 = "sha256-F4nWsbGlff4qere1M+6fXf2cv1tZuxuzwmEu0I0PaLI=";
   };
 
   outputs = ["out" "apparmor"];
@@ -16,11 +16,6 @@ stdenv.mkDerivation rec {
   patches = [
     # https://git.congatec.com/yocto/meta-openembedded/commit/3402bfac6b595c622e4590a8ff5eaaa854e2a2a3
     ./inetutils-1_9-PATH_PROCNET_DEV.patch
-    (fetchpatch {
-      name = "CVE-2022-39028.patch";
-      url = "https://sources.debian.org/data/main/i/inetutils/2%3A2.3-5/debian/patches/inetutils-telnetd-EC_EL_null_deref.patch";
-      sha256 = "sha256-NYNDbEk3q3EhQdJaR12JBbnjJIRRpOcKLBF/EJJPiGU=";
-    })
   ];
 
   nativeBuildInputs = [ help2man perl /* for `whois' */ ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9456fdfe648..3e880dc4df6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19489,8 +19489,11 @@ with pkgs;
   icu71 = callPackage ../development/libraries/icu/71.nix ({
     nativeBuildRoot = buildPackages.icu71.override { buildRootOnly = true; };
   });
+  icu72 = callPackage ../development/libraries/icu/72.nix ({
+    nativeBuildRoot = buildPackages.icu72.override { buildRootOnly = true; };
+  });
 
-  icu = icu71;
+  icu = icu72;
 
   id3lib = callPackage ../development/libraries/id3lib { };
 
@@ -25706,6 +25709,7 @@ with pkgs;
       enableMinimal = true;
       guiSupport = false;
     };
+    libbpf = libbpf_1;
   };
   systemdMinimal = systemd.override {
     pname = "systemd-minimal";
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index d8d4320f0c0..bb25b2df7a0 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -1100,10 +1100,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "19ynyc7wzl71hn7jw467xr188v0az679l54167slm3jh5mx6rijf";
+      sha256 = "03qiz6kbk260v3613z4wrk8iy1mi06j631fglcskfxyhf18lpy05";
       type = "gem";
     };
-    version = "6.0.7";
+    version = "6.0.8";
   };
   hashie = {
     groups = ["default"];
@@ -1325,6 +1325,17 @@
     };
     version = "0.1.4";
   };
+  jekyll-favicon = {
+    dependencies = ["jekyll" "mini_magick" "rexml"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0dyksm4i11n0qshd7wh6dvk8d0fc70dd32ir2dxs6igxq0gd6hi1";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
   jekyll-feed = {
     dependencies = ["jekyll"];
     groups = ["default"];
@@ -1752,10 +1763,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0rsgvdyh828k6bz95b4391ydv6710d4dsdrrfr684glks7599ldf";
+      sha256 = "1jbqw7hkx08i5dj74fwfdc16980hsj3mhrxp4mmjxsdzw1kndrvp";
       type = "gem";
     };
-    version = "3.2.3";
+    version = "3.2.4";
   };
   liquid = {
     groups = ["default"];